[QUESTION] How to catch misspelled/unknown parameters?

How can I catch misspelled or unknown query parameters? For instance:

from fastapi import FastAPI

app = FastAPI()

@app.get("/")
def root(myparam: int = 0):
    return {'myparam': myparam}

$ curl http://127.0.0.1:8000/?param=5
{"myparam":0}

It seems bad to silently accept the unknown param parameter. The caller wouldn’t be aware that they misspelled the parameter and that it remained at its default value.

[tiangolo]

Thanks for the discussion here everyone.

FastAPI is based on OpenAPI, which is based on JSON Schema. That by default allows extra values and defines validation for the ones provided. So forbidding extra parameters wouldn’t be acceptable as a default.

There are also many systems that add additional query parameters being used or not, e.g. Google Analytics, Facebook, etc. So I don’t think it would work well for many use cases.

---

But on the other side, I see this could be useful in some cases (like yours), so I think we could have a path operation decorator parameter allow_extra_parameters=True that conditionally triggers your proposed change.

If you want, you could create a PR with that 🤓 🚀

[bear24rw]

I agree that there should be a way to disable this check but I would argue that fastapi should be strict about the api spec by default to catch bugs quicker.

In fact, I don’t quite understand what errors can be caused by the fact that you accept exrta parameters in the query string.

The word “extra” is maybe not the best word to use, “unknown” would be better. I’m trying to catch people misspelling the optional query parameters on accident (which actually happened and burned a lot of time). As another example:

@app.get("/members")
def members(exclude_vip: bool = False):
       ....

GET /members?excludevip=1

It might not be obvious from the response that your parameter was ignore (maybe there are thousands of members and only a handful of vip members so either way you get back a huge list)

The intention of my patch is to catch these kind of bugs by default, just like we catch value type errors by default. If someone is sending truly extra params then I would argue that is the non-default exceptional case.